[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH 1/9] parallels: Out of image offset in BAT leads to image inflati
From: |
Alexander Ivanov |
Subject: |
[PATCH 1/9] parallels: Out of image offset in BAT leads to image inflation |
Date: |
Thu, 18 Aug 2022 17:14:48 +0200 |
data_end field in BDRVParallelsState is set to the biggest offset present
in BAT. If this offset is outside of the image, any further write will create
the cluster at this offset and/or the image will be truncated to this
offset on close. This is definitely not correct.
Raise an error in parallels_open() if data_end points outside the image and
it is not a check (let the check to repaire the image).
Signed-off-by: Alexander Ivanov <alexander.ivanov@virtuozzo.com>
---
block/parallels.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/block/parallels.c b/block/parallels.c
index a229c06f25..c245ca35cd 100644
--- a/block/parallels.c
+++ b/block/parallels.c
@@ -732,6 +732,7 @@ static int parallels_open(BlockDriverState *bs, QDict
*options, int flags,
BDRVParallelsState *s = bs->opaque;
ParallelsHeader ph;
int ret, size, i;
+ int64_t file_size;
QemuOpts *opts = NULL;
Error *local_err = NULL;
char *buf;
@@ -811,6 +812,19 @@ static int parallels_open(BlockDriverState *bs, QDict
*options, int flags,
}
}
+ file_size = bdrv_getlength(bs->file->bs);
+ if (file_size < 0) {
+ ret = file_size;
+ goto fail;
+ }
+
+ file_size >>= BDRV_SECTOR_BITS;
+ if (s->data_end > file_size && !(flags & BDRV_O_CHECK)) {
+ error_setg(errp, "parallels: Offset in BAT is out of image");
+ ret = -EINVAL;
+ goto fail;
+ }
+
if (le32_to_cpu(ph.inuse) == HEADER_INUSE_MAGIC) {
/* Image was not closed correctly. The check is mandatory */
s->header_unclean = true;
--
2.34.1
- [PATCH 7/9] parallels: Out of image offset in BAT leads to image inflation, (continued)
- [PATCH 7/9] parallels: Out of image offset in BAT leads to image inflation, Alexander Ivanov, 2022/08/08
- [PATCH 6/9] parallels: Replace qemu_co_mutex_lock by WITH_QEMU_LOCK_GUARD, Alexander Ivanov, 2022/08/08
- [PATCH 5/9] parallels: Move statistic collection to a separate function, Alexander Ivanov, 2022/08/08
- [PATCH 8/9] parallels: Replace bdrv_co_pwrite_sync by bdrv_co_flush for BAT flushing, Alexander Ivanov, 2022/08/08
- [PATCH 9/9] parallels: Merge parallels_check_fragmentation to parallels_collect_statistics, Alexander Ivanov, 2022/08/08
- [PATCH 0/9] parallels: Refactor the code of images checks and fix a bug, Alexander Ivanov, 2022/08/18
- [PATCH 1/9] parallels: Out of image offset in BAT leads to image inflation,
Alexander Ivanov <=
- [PATCH 3/9] parallels: create parallels_set_bat_entry_helper() to assign BAT value, Alexander Ivanov, 2022/08/18
- [PATCH 2/9] parallels: Fix data_end field value in parallels_co_check(), Alexander Ivanov, 2022/08/18
- [PATCH 9/9] parallels: Replace qemu_co_mutex_lock by WITH_QEMU_LOCK_GUARD, Alexander Ivanov, 2022/08/18
- [PATCH 7/9] parallels: Move check of leaks to a separate function, Alexander Ivanov, 2022/08/18
- [PATCH 5/9] parallels: Move check of unclean image to a separate function, Alexander Ivanov, 2022/08/18
- [PATCH 6/9] parallels: Move check of cluster outside image to a separate function, Alexander Ivanov, 2022/08/18
- [PATCH 4/9] parallels: Use generic infrastructure for BAT writing in parallels_co_check(), Alexander Ivanov, 2022/08/18